PT-2022-16249 · WordPress · Directorist

Krzysztof Zając · Published 2022-09-05 · Updated 2022-09-08 · CVE-2022-2376

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Directorist WordPress plugin versions prior to 7.3.1

Description The issue concerns the disclosure of email addresses of all users through an AJAX action. This action is accessible to both unauthenticated and any authenticated users.

Recommendations For versions prior to 7.3.1, update to version 7.3.1 or later to resolve the issue.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-2376

Affected Products

Directorist

References · 4

• 🔥 https://wpscan.com/vulnerability/437c4330-376a-4392-86c6-c4c7ed9583ad · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-2376 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2376 · Vendor Advisory
• https://t.me/cibsecurity/49285 · Telegram Post